2017-11-15 - BRAZIL MALSPAM PUSHES BANLOAD MALWARE

ASSOCIATED FILES:

  • 2017-11-15-Brazil-malspam-pushes-Banload.pcap   (10,065,400 bytes)
  • 2017-11-15-Banload-malspam-1415-UTC.eml   (1,571 bytes)
  • BrofWorks0.dat   (15 bytes)
  • BrofWorks0.exe   (373,434,880 bytes)
  • SYS547474548446832   (9,977,886 bytes)
  • whatsapp_Foto_safada_as_completo.exe   (3,355,648 bytes)
  • whatsapp_Foto_safada_as_completo.zip   (1,547,986 bytes)

 

EMAIL


Shown above:  Screenshot from the email.

 

EMAIL INFO:

 

TRAFFIC


Shown above:  Infection traffic filtered in Wireshark.

 

URLS FROM THE INFECTION TRAFFIC:

 

MALWARE

DOWNLOADED MALWARE:

 

POST-INFECTION MALWARE:

 

IMAGES


Shown above:  Clicking a link in the email returns the initial zip archive.

 


Shown above:  The downloaded zip archive contains malware.

 


Shown above:  Some artifacts seen during this infection.

 


Shown above:  Shortcut added to the Start Menu to create a persistent infection.

 

FINAL NOTES

Once again, here are the associated files:

Zip archives are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.